shadowscan

<p>ShadowScan Security Link pairs your site to the ShadowScan portal and keeps it in sync with heartbeat status, Guard Layer signals, login abuse detection, and security commands.</p>
<p>ShadowScan does not install, activate, or configure third-party security tools. If another security plugin is present, the connector only records its presence as metadata.</p>
<h3>External services</h3>
<p>This plugin connects to external services to sync status, process security workflows, and support optional diagnostics.</p>
<ul>
<li>Service: ShadowScan API (hosted at Supabase Edge Functions)</li>
<li>URL: https://foemwjtosslaiynduiyt.supabase.co/functions/v1/</li>
<li>Used for: site pairing, heartbeat sync, command polling, command-result upload, subscription/policy sync, and support contact submissions.</li>
<li>Data sent and when: site URL, WordPress version, PHP version, connector version, Guard Layer/control status, heartbeat timestamps, and command execution metadata whenever the connector syncs with ShadowScan; contact form fields only when an admin submits support contact.</li>
<li>Terms: https://shadowscan.com.au/terms</li>
<li>
<p>Privacy: https://shadowscan.com.au/privacy</p>
</li>
<li>
<p>Service: Have I Been Pwned Passwords API</p>
</li>
<li>URL: https://api.pwnedpasswords.com</li>
<li>Used for: optional breached-password checks in password policy enforcement.</li>
<li>Data sent and when: k-anonymity password hash prefix (first 5 SHA-1 characters, no raw passwords) only when a password is checked by the policy flow.</li>
<li>Terms: https://haveibeenpwned.com/TermsOfUse</li>
<li>
<p>Privacy: https://haveibeenpwned.com/Privacy</p>
</li>
<li>
<p>Service: Sentry</p>
</li>
<li>URL: https://sentry.io</li>
<li>Used for: optional error and fatal-event telemetry to assist troubleshooting.</li>
<li>Data sent and when: error event metadata (such as exception messages, stack traces, and runtime context) only after an admin explicitly enables Sentry telemetry in plugin settings and a Sentry DSN is configured; the optional MU diagnostics helper can send early-startup fatal errors only while both Sentry telemetry and remote diagnostics are enabled.</li>
<li>Terms: https://sentry.io/terms/</li>
<li>Privacy: https://sentry.io/privacy/</li>
</ul>
<h3>Third-Party Libraries</h3>
<p>This plugin bundles:<br />
* pragmarx/google2fa (MIT License)<br />
* bacon/bacon-qr-code (BSD-2-Clause; Copyright (c) 2017-present, Ben Scholzen “DASPRiD”)</p>
<h3>Hooks</h3>
<p>shadowscan_log<br />
Fires when the plugin emits an internal log message. You can hook this in a must‑use plugin or theme if you want to capture logs.</p>


ShadowScan Security Link

Connects your WordPress site to the ShadowScan portal for heartbeats, guard signals, and security commands.

ifsolutions

<p>DreamCore Monitor is a powerful WordPress monitoring plugin that provides comprehensive insights into your website’s security, performance, and integrity.</p>
<p><strong>External Services</strong>: This plugin connects to external services including ip-api.com for IP geolocation, api.wordpress.org for WordPress core information, and api.github.com for enhanced plugin analysis. See the “External Services” section below for complete details about data transmission and privacy.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Login Monitoring</strong> – Track successful and failed login attempts with detailed information including IP addresses, user agents, and geographic data</li>
<li><strong>WordPress Core Status</strong> – Monitor WordPress version and check for available updates</li>
<li><strong>Plugin Monitoring</strong> – Track active plugins, their versions, and available updates with intermediate version information</li>
<li><strong>Theme Monitoring</strong> – Monitor active theme status and available updates</li>
<li><strong>File Integrity Checking</strong> – Verify WordPress core files against official checksums to detect unauthorized modifications</li>
<li><strong>WooCommerce Integration</strong> – Monitor recent orders when WooCommerce is active</li>
<li><strong>REST API Support</strong> – External access to monitoring data via secure API endpoints</li>
<li><strong>Sync Functionality</strong> – Incremental data synchronization with external monitoring systems</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>API key verification with external monitoring systems</li>
<li>Secure authentication for REST API endpoints</li>
<li>Input sanitization and validation</li>
<li>File integrity monitoring with checksum verification</li>
<li>Login attempt tracking with geographic information</li>
<li>Nonce protection for form submissions</li>
</ul>
<h4>REST API Endpoints</h4>
<p>When an API key is configured, the following endpoints are available:</p>
<ul>
<li><code>/wp-site-monitor/v1/site-info</code> – General site information</li>
<li><code>/wp-site-monitor/v1/logins</code> – Login attempt logs</li>
<li><code>/wp-site-monitor/v1/logins/sync</code> – Incremental login data sync</li>
<li><code>/wp-site-monitor/v1/core-version</code> – WordPress core version status</li>
<li><code>/wp-site-monitor/v1/plugins</code> – Active plugins information</li>
<li><code>/wp-site-monitor/v1/themes</code> – Theme information</li>
<li><code>/wp-site-monitor/v1/integrity</code> – File integrity check results</li>
<li><code>/wp-site-monitor/v1/orders</code> – WooCommerce orders (if WooCommerce is active)</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li><strong>Website Security Monitoring</strong> – Track login attempts and detect suspicious activity</li>
<li><strong>Maintenance Management</strong> – Monitor WordPress core, plugin, and theme updates across multiple sites</li>
<li><strong>File Integrity Verification</strong> – Detect unauthorized changes to WordPress core files</li>
<li><strong>External Monitoring Integration</strong> – Connect with external monitoring systems via REST API</li>
<li><strong>WooCommerce Store Monitoring</strong> – Keep track of recent orders and store activity</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 5.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>Optional: WooCommerce plugin for order monitoring features</li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to the following external services to provide its functionality:</p>
<h4>IP Geolocation Service (ip-api.com)</h4>
<ul>
<li><strong>Purpose</strong>: Obtain geographical location information for login monitoring and security analysis</li>
<li><strong>Data sent</strong>: User’s IP address only</li>
<li><strong>When</strong>: Each time a user logs in to your WordPress site (if geolocation is enabled)</li>
<li><strong>Frequency</strong>: Once per login attempt</li>
<li><strong>Data retention</strong>: This plugin does not store data from this service permanently</li>
<li><strong>Privacy Policy</strong>: http://ip-api.com/docs/legal</li>
<li><strong>Terms of Service</strong>: http://ip-api.com/docs/legal</li>
<li><strong>User Control</strong>: Site administrators can disable geolocation in plugin settings</li>
</ul>
<h4>WordPress Core API (api.wordpress.org)</h4>
<ul>
<li><strong>Purpose</strong>: Check for available WordPress core updates, plugin information, and core file checksums</li>
<li><strong>Data sent</strong>: Current WordPress version, site URL (as User-Agent header), plugin slugs, and locale information</li>
<li><strong>When</strong>: During scheduled update checks and plugin analysis (typically daily)</li>
<li><strong>Frequency</strong>: Multiple times per day during normal plugin operation</li>
<li><strong>Data retention</strong>: This plugin does not store data from this service permanently</li>
<li><strong>Privacy Policy</strong>: https://wordpress.org/about/privacy/</li>
<li><strong>Terms of Service</strong>: https://wordpress.org/about/gpl/</li>
<li><strong>User Control</strong>: This is essential for plugin functionality and cannot be disabled</li>
</ul>
<h4>GitHub API (api.github.com)</h4>
<ul>
<li><strong>Purpose</strong>: Analyze plugin update information from GitHub repositories for enhanced update type detection</li>
<li><strong>Data sent</strong>: Repository information and release data requests</li>
<li><strong>When</strong>: During plugin update analysis (when available)</li>
<li><strong>Frequency</strong>: During plugin update checks (typically daily)</li>
<li><strong>Data retention</strong>: This plugin caches repository information temporarily (24 hours)</li>
<li><strong>Privacy Policy</strong>: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement</li>
<li><strong>Terms of Service</strong>: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service</li>
<li><strong>User Control</strong>: This is part of the enhanced plugin analysis feature</li>
</ul>
<h4>Data Handling and Privacy</h4>
<ul>
<li><strong>Local Storage</strong>: All monitoring data is stored locally in your WordPress database</li>
<li><strong>No Personal Data</strong>: The plugin does not collect personal user information beyond what’s necessary for monitoring</li>
<li><strong>Data Retention</strong>: Login logs are automatically deleted based on your configured retention period (default: 90 days)</li>
<li><strong>External Transmission</strong>: Data is only sent to external services as described above</li>
<li><strong>User Rights</strong>: Site administrators can clear all plugin data at any time</li>
</ul>
<h4>GDPR Compliance</h4>
<p>This plugin respects user privacy and GDPR guidelines:<br />
* IP address geolocation is optional and can be disabled<br />
* Login monitoring data is stored locally and automatically purged<br />
* No personal data is transmitted to external services beyond IP addresses for geolocation<br />
* Users can request deletion of their monitoring data through the site administrator</p>
<h4>Disabling External Services</h4>
<ul>
<li><strong>Geolocation</strong>: Can be disabled in plugin settings (Settings > Geolocation)</li>
<li><strong>WordPress API</strong>: Cannot be disabled as it’s essential for core functionality</li>
<li><strong>GitHub API</strong>: Used automatically when available, no separate disable option</li>
</ul>
<h3>Privacy Policy</h3>
<h4>Data Collection</h4>
<p>DreamCore Monitor collects and stores the following information locally in your WordPress database:</p>
<ul>
<li><strong>Login Attempts</strong>: Usernames, IP addresses, user agents, timestamps, and login success/failure status</li>
<li><strong>System Information</strong>: WordPress version, plugin/theme information, file checksums</li>
<li><strong>WooCommerce Data</strong>: Order information if WooCommerce is active (order IDs, customer names, amounts, status)</li>
</ul>
<h4>External Services</h4>
<p>This plugin connects to external services as detailed in the “External Services” section above:<br />
* IP geolocation via ip-api.com (optional)<br />
* WordPress core information via api.wordpress.org (required)<br />
* GitHub repository analysis via api.github.com (automatic)</p>
<h4>Data Retention</h4>
<ul>
<li>Login logs are automatically deleted based on your configured retention period (default: 90 days)</li>
<li>System monitoring data is refreshed during each check</li>
<li>External service data is not stored permanently</li>
</ul>
<h4>User Rights</h4>
<ul>
<li>Site administrators can clear all plugin data at any time</li>
<li>Geolocation can be disabled in plugin settings</li>
<li>Users can request deletion of their login attempt data through the site administrator</li>
</ul>
<h4>GDPR Compliance</h4>
<p>This plugin respects user privacy and follows GDPR guidelines. No personal data is transmitted to external services except IP addresses for optional geolocation purposes..</p>


DreamCore Monitor

WordPress monitoring solution that tracks login attempts, core status, plugin updates, theme status, and file integrity.

ShadowScan Security Link vs DreamCore Monitor